Executive brief
The Linux kernel's Ceph filesystem component contains a use-after-free vulnerability in cap flush handling. An attacker with local access can exploit a race condition between concurrent operations to crash the kernel or potentially execute arbitrary code, leading to denial of service or system compromise.
Technical details
The vulnerability is a use-after-free (UAF) in the Ceph filesystem's __kick_flushing_caps() function. The issue occurs when list_for_each_entry() iterates over ci->i_cap_flush_list while temporarily releasing the i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can detach and free cap flush (cf) entries via ceph_free_cap_flush(). When the original thread reacquires the lock and the for-loop macro advances, it dereferences the next pointer of already-freed memory. The race is triggered when the MDS responds with a FLUSH_ACK quickly enough that the cf entry is freed before __kick_flushing_caps() completes iteration. The fix converts the vulnerable macro-based iteration to a manual while loop that saves the next pointer under lock before releasing it, preventing any access to freed memory after reacquisition.
Affected products
- Linux Linux kernel versions with Ceph filesystem support prior to fix
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory: CVE-2026-89655